Using NLB IPs for Private Connectivity

Applicability

Description

Private connectivity to Splunk Cloud is designed to route ingestion traffic through internal AWS resources. In environments where Network Load Balancers (NLBs) are configured as part of the private input endpoint (e.g., `inputs.pvt.<stack>.splunkcloud.com`), the associated **NLB IP addresses are valid and required** for allow-listing and secure communication.
As documented in Splunk’s Private Connectivity Setup, the NLB handles internal routing from the user org VPC to Splunk indexers, making the NLB IPs the appropriate targets for firewall or security group rules in private deployments.

Investigation

A review of the user stack confirmed that the input endpoint was configured with NLBs for private connectivity. These NLB IPs are used internally to reach Splunk Cloud indexers and are therefore necessary for proper configuration of source-side security controls.

Resolution

The NLB IP addresses associated with private input endpoints should be used when configuring firewall rules, route tables, or allow-lists for private connectivity to Splunk Cloud. These IPs serve as the entry points to the Splunk ingestion layer in private connectivity environments and are supported.

Related Links

Enable Private connectivity

About Private Connectivity.